I'd just like to add an important note that may help other users:
Before following this tutorial, I was able to access the cPFence WebUI (port 9095) both via the server’s IP and through the Enhance panel address with port 9095.
After completing all the steps in the tutorial — including setting up the Cloudflare Tunnel, enabling OTP authentication, and applying the Zero Trust access policy — access via the protected subdomain worked perfectly.
However, direct public access to port 9095 remained possible, meaning that anyone who knew the IP and port could still access the WebUI without going through the tunnel.
I was only able to fully block this external access after explicitly running:
sudo ufw deny in 9095
that is, configuring the server firewall to deny public access to the port.
It might be helpful to include this step in the tutorial, to ensure the WebUI is truly inaccessible from the public internet and can only be reached through the Cloudflare Tunnel + Zero Trust.
